Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sumcheck protocol support mixed num_vars monomial form #235

Merged
merged 2 commits into from
Sep 19, 2024

Conversation

hero78119
Copy link
Collaborator

@hero78119 hero78119 commented Sep 17, 2024

Goal

To make sumcheck protocol support different num_vars, aiming for

  • minimal change to sumcheck protocol, make verifier remain the same. no extra meta data passed from prover, and what prover have just mle and it's eval size

Besides this PR also remove some parallism in verifier since it's unnecessary for relative low cost.

design rationale

(Also comments in codebase for reference)
To deal with different num_vars, we exploit a fact that for each product which num_vars < max_num_vars,
for it evaluation value we need to times 2^(max_num_vars - num_vars)
E.g. Giving multivariate poly $f(X) = f_1(X1) + f_2(X), X1 \in {F}^{n'}, X \in {F}^{n}, |X1| := n', |X| = n, n' &lt;= n$
For i round univariate poly, $f^i(x)$
$f^i[0] = \sum_b f(r, 0, b), b \in [0, 1]^{n-i-1}, r \in {F}^{n-i-1}$ chanllenge get from prev rounds
= $\sum_b f_1(r, 0, b1) + f_2(r, 0, b), |b| &gt;= |b1|, |b| - |b1| = n - n'$
= $2^{(|b| - |b1|)} * \sum_{b1} f_1(r, 0, b1) + \sum_b f_2(r, 0, b)$
same applied on f^i[1]
It imply that, for every evals in f_1, to compute univariate poly, we just need to times a factor 2^(|b| - |b1|) for it evaluation value

benchmark

benchmark with ceno_zkvm riscv_add, and gkr keccak both remain the same and no impact.
You might see some redundancy coding style, but this is for retain the best performance. I tried other variants and it impact benchmark results

scope

Related to #109 #210 ....
To address #126 #127
This enhance protocol features potiential can be used for range table-circuit, init/final-memory, cpu-init/cpu-final halt to make selector sumcheck support batching different num_instance witin.

@hero78119 hero78119 marked this pull request as draft September 17, 2024 15:22
@hero78119 hero78119 changed the title sumcheck protocol support mixed num_vars monomial form [WIP] sumcheck protocol support mixed num_vars monomial form Sep 18, 2024
@hero78119 hero78119 marked this pull request as ready for review September 18, 2024 15:49
@hero78119
Copy link
Collaborator Author

hero78119 commented Sep 19, 2024

@kunxian-xia I plan to study what the minimal change to batching multiple table (or similar) circuit in single create_table_proof after this PR, since each table circuit only contribute one wit-in. The previous blocker for batching them is on selector sumcheck which require on same num_instance (whereas tower protocol already support)
So after this features it's possible for us to batch those naive constrains system into the same sumcheck proof

@hero78119 hero78119 changed the title [WIP] sumcheck protocol support mixed num_vars monomial form sumcheck protocol support mixed num_vars monomial form Sep 19, 2024
@hero78119 hero78119 force-pushed the feat/state_circuit branch 2 times, most recently from ab7bb73 to 289bca3 Compare September 19, 2024 03:19
@@ -418,13 +449,24 @@ impl<'a, E: ExtensionField> IOPProverStateV2<'a, E> {
let f = &self.poly.flattened_ml_extensions[products[0]];
op_mle! {
|f| {
(0..f.len())
let res = (0..largest_even_below(f.len()))
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea behind this is for skip f.len() == 1 assuring we dont need to add extra boundary check in line 455/456 so no performance impact

Copy link
Collaborator

@dreamATD dreamATD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@hero78119 hero78119 merged commit 43af034 into master Sep 19, 2024
6 checks passed
@hero78119 hero78119 deleted the feat/state_circuit branch September 19, 2024 12:16
hero78119 added a commit that referenced this pull request Sep 30, 2024
### Goal
To make sumcheck protocol support different num_vars, aiming for
- [x] minimal change to sumcheck protocol, make verifier remain the
same. no extra meta data passed from prover, and what prover have just
mle and it's eval size

Besides this PR also remove some parallism in verifier since it's
unnecessary for relative low cost.

### design rationale
(Also comments in codebase for reference)
To deal with different num_vars, we exploit a fact that for each product
which num_vars < max_num_vars,
for it evaluation value we need to times 2^(max_num_vars - num_vars)
E.g. Giving multivariate poly $f(X) = f_1(X1) + f_2(X), X1 \in {F}^{n'},
X \in {F}^{n}, |X1| := n', |X| = n, n' <= n$
For i round univariate poly, $f^i(x)$
$f^i[0] = \sum_b f(r, 0, b), b \in [0, 1]^{n-i-1}, r \in {F}^{n-i-1}$
chanllenge get from prev rounds
= $\sum_b f_1(r, 0, b1) + f_2(r, 0, b), |b| >= |b1|, |b| - |b1| = n -
n'$
= $2^{(|b| - |b1|)} * \sum_{b1} f_1(r, 0, b1) + \sum_b f_2(r, 0, b)$
same applied on f^i[1]
It imply that, for every evals in f_1, to compute univariate poly, we
just need to times a factor 2^(|b| - |b1|) for it evaluation value


### benchmark
benchmark with ceno_zkvm `riscv_add`, and gkr `keccak` both remain the
same and no impact.
You might see some redundancy coding style, but this is for retain the
best performance. I tried other variants and it impact benchmark results

### scope
Related to #109 #210 ....
To address #126 #127 
This enhance protocol features potiential can be used for `range
table-circuit`, `init/final-memory`, `cpu-init/cpu-final halt` to make
selector sumcheck support batching different num_instance witin.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants